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Amendments to the Specification: 

Please replace the indicated paragraphs with the following amended paragraph(s): 

[0010] Protecting information systems from various forms of attack has long been of 
concern to practitioners in the field. Some forms of protection are built into operating 
systems, such as user and/or password authentication. Other forms of protection include 
various software and sometimes hardware strategies. A very commonly used form of 
protection is anti-virus software. Inventor Fred Cohen, as early as 1988, proposed and 
implemented an integrity shell, which was a program that run in an operating system kernel space 
and used a modified execution system call to verify a check sum over every program before executing 
that program. Such a modified system call allowed the system to protect against viruses that hid 
within executable components, because the presence of such viruses would change the checksum of 
those executable components. Further information about this work is available at 
http://aH Tall(.) net/books/integ/vmodels.html. 

[0011] It is believed to be generally known to modify parts of an operating system, 
including parts of kernel system calls, for various reasons. In some cases, modified system 
calls will preserve original system calls in order to remove modifications or in order to run 
original system calls after the modified portion is run. For example, such techniques are 
discussed in "The Linux Kernel Module Programming Guide" by Ori Pomerantz, believed 
available 1999-05-19. ( see www rwww( .) tldpTer g( ■)org /LDP/lkmpg/node20.html.) 
[0012] Various strategies used in computer systems have at times included providing 
some type of misinformation. Some logic modules, for example, are designed to hide 
themselves from various operating system functions, such as process viewing functions, and 
thus can cause functions to provide a list of processes and/or files and/or users, for example, 
that are not complete. One use of such a strategy is mentioned in the context of a program 
referred to as the Kernel Intrusion System. This program is described as a kernel level rootkit 
that, among other things, makes modifications to the kernel to get some privileges, and hides 
itself from system administrators. Further information is available at 
www TWWwfO packetstormsecurityTOi^g CQorg /UNIX /penetration/ rootkits/kis-0.9.tar.gz. 
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